Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Weekly Threat Intelligence - March 28–01

Cyware Weekly Threat Intelligence - March 28–01 - Featured Image

Weekly Threat Briefing Apr 1, 2022

The Good

There is always a reason to celebrate when cybercriminals get busted. This week, the FBI dismantled a notorious cybercrime ring that stole millions of dollars from American businesses through business email compromise schemes. On a different note, we saw several positive developments in the form of international agreements on cybersecurity. For instance, Singapore and the U.S. agreed to strengthen their cooperation through a new annual cybersecurity dialogue.

  • Under “Operation Eagle Sweep,” the FBI dismantled a major cybercrime operation engaged in business email compromise schemes. Starting in September 2021, the authorities arrested 65 suspects in the United States, Nigeria, South Africa, Cambodia, and Canada.

  • The Australian government sets aside approximately $7.5 billion in funds for boosting cybersecurity and intelligence capabilities within the country.

  • A team of researchers designed a new system to tackle concerns related to invasive tracking. Dubbed Privid, the system enables video analytics in a privacy-preserving way.

  • U.S. lawmakers proposed a new bill that would focus on strengthening the cybersecurity posture of the American healthcare and public health sector. The Healthcare Cybersecurity Act aims to enhance collaboration between the CISA and the HHS.

  • The EU and the U.S. reached an agreement on reviving trans-Atlantic data flows deal. The deal would ensure “predictable, trustworthy data flows between the EU and the U.S., safeguarding privacy and civil liberties.”

  • Singapore and the U.S. will be holding a yearly dialogue as part of strengthening cooperation on combating cyberthreats while promoting resilience and securing critical infrastructure.

The Bad

The healthcare sector remains a favorite target of cyberattackers. This week a health plan provider for law enforcement officials, LEHB, disclosed falling prey to a ransomware attack that lead to huge data loss. Even the education sector has come under the attackers' crosshairs as the personal data of hundreds of thousands of NYC students was leaked. While looking for new jobs, beware of getting phished as thousands of fake job offers are being circulated by scammers.

  • The personal information of roughly 820,000 current and former New York City public school students was affected in a breach that occurred in January after threat actors gained unauthorized access to an online grading system and attendance system.

  • Hackers are compromising WordPress sites to use visitors’ browsers as a channel to launch DDoS attacks on Ukrainian websites belonging to government agencies, think tanks, recruitment sites for the International Legion of Defense of Ukraine, and banking.

  • Researchers are warning against active exploitation of the Log4Shell vulnerability, to deliver backdoors and cryptocurrency miners onto vulnerable VMware Horizon servers. The campaign leverages remote monitoring software packages, Atera or Spashtop, and the Sliver backdoor.

  • A threat actor dubbed RED-LILI was linked to an ongoing large-scale supply chain attack campaign that targets the NPM package repository. Researchers found nearly 800 malicious packages that were published in the repository via a fully-automated system that enabled the attacker to bypass the verification process.

  • Threat actors have been found sending nearly 4,000 phishing emails related to fake jobs to trick victims into sharing their personal data or committing money laundering. In order to look convincing, these phishing emails include logos for corporate brandings, spoofed university addresses, Google Forms, and fake checks.

  • A ransomware attack at Shutterfly affected the personal information of its employees. The attack occurred on December 3, 2021, after which the Conti ransomware group had leaked around 7.05GB of stolen data on its site. Apart from stealing employee data, the gang had also encrypted over 4,000 devices and 120 VMware ESXi servers.

  • Cyber attackers hacked the Ronin network of Axie Infinity, the blockchain-based game, and stole more than $620 million in cryptocurrency. They used hacked private keys to forge fake withdrawals.

  • The Lapsus$ gang announced its return on Telegram by leaking confidential information stolen from software firm Globant. Around 70GB of source code and administrator passwords associated with the firm’s Atlassian suite, stolen by threat actors, is available on their Telegram channel.

  • Law Enforcement Health Benefits (LEHB) disclosed a ransomware attack that occurred last year. According to the organization, attackers encrypted files on September 14, 2021. Among the files affected include the personal information of more than 85,000 users.

  • Hive ransomware gang has claimed to have stolen 850,000 PII records from Partnership HealthPlan of California (PHC). The stolen data includes names, social security numbers, and addresses of users. Around 400GB of stolen files from the healthcare organization’s server has been posted on Hive’s dark website.

  • Kaspersky unmasked North Korea state-backed hackers distributing an infected DeFi wallet for cryptocurrency assets. The campaign, possibly conducted by Lazarus, has the capability to gain full access to the targeted systems.

  • Phishers are abusing Microsoft Azure’s Static Web Apps service to steal Microsoft, Office 365, Outlook, and OneDrive credentials. Researchers noticed that threat actors leveraged custom branding and web hosting features to host static landing phishing pages. Each landing page automatically gets its own secure page padlock in the address bar due to the *.1.azurestaticapps.net wildcard TLS certificate.

  • Two vulnerabilities have been found affecting Rockwell Programmable Logic Controllers. They are tracked as CVE-2022-1161 and CVE-2022-1159. While the former affects numerous versions of Rockwell’s Logix Controllers, the latter impacts several versions of its Studio 5000 Logix Designer application. The flaws can allow attackers to launch Stuxnet-style attacks on PLCs.

**New Threats **

The last couple of months has been a fruitful time for data wipers. We found the seventh new wiper malware of the year in a new discovery this week. Dubbed AcidRain, it is raining attacks on modems and routers. A new conversation hijacking campaign was found propagating the IcedID trojan. You have heard about conventional obfuscation; now get ready for IPfuscation. This novel tactic is being used by Hive ransomware.

  • Avast has discovered a new Remote Access Tool (RAT) that is being actively used in the wild in the Philippines. The RAT leverages an expired digital certificate belonging to the Philippines Navy to communicate on the C2 server. According to researchers, the malware used in the campaign is written in C++.
  • The SunCrypt ransomware has been updated with new capabilities to terminate processes, stop services, and clean the machine of any evidence of the ransomware infection. The ransomware variant was first updated in 2022 and is still under development. The attackers also plan to include an anti-VM feature in the ransomware in the future.
  • Hive ransomware gang is using a new IPfuscation tactic to hide its payload. Here, the threat actors hide 64-bit Windows executables inside IPv4 addresses, which eventually causes the download of the Cobalt Strike Beacon.
  • Researchers detected a new conversation hijacking campaign that delivers the IcedID trojan onto the victim’s system. As part of the campaign, threat actors also used compromised Microsoft Exchange servers to send emails from the hijacked accounts. Organizations in the energy, healthcare, law, and pharmaceutical sectors have fallen victim to these attacks.
  • A new Transparent Tribe APT campaign targeting the Indian government and military officials has been uncovered by researchers. The campaign has been ongoing since June 2021 and uses fake domains mimicking legitimate sites to deliver Crimson RAT, a Python-based stager, and a NET-based downloader.
  • Researchers have discovered a new Wslink malware loader that runs as a server and executes modules in memory. The malware makes use of the process virtual machine as part of its obfuscation process.
  • A newly discovered malware loader, dubbed Verblecon, is being used to install cryptocurrency miners on infected machines. Despite being around for more than a year, the malware sample is able to maintain a low detection rate due to the polymorphic nature of the code. Researchers claim that cybercriminals may use the loader in the future to disseminate ransomware and even launch espionage attacks.
  • A new variant of Mars Stealer is being used widely in multiple large-scale attack campaigns. In one such campaign, threat actors were spotted using Google Ads for OpenOffice installer to distribute the malware variant. The campaign primarily targeted users in Canada. According to researchers, the new Mars variant is capable of pilfering browser auto-fill data, browser extension data, credit cards, IP address, country code, and timezone, among others.
  • A newly discovered Python-based ransomware has been found targeting the Jupyter Notebook tool to cause significant damage to organizations. The attackers are scanning the internet for applications that are left exposed with no passwords.
  • A new wave of Remcos RAT campaign, set around the payment remittance theme, has been observed by researchers. The emails appear to come from financial institutions and include a malicious Excel file that starts the infection chain process.
  • A Chinese hacking group Deep Panda targeted VMware Horizon servers to deploy a new rootkit called ‘Fire Chili’. The attack exploited Log4Shell vulnerability to gain initial access to networks. The rootkit enabled the attackers to evade detection on compromised systems.
  • A new information-stealing malware, named BlackGuard, is being sold on the hacking forum for a lifetime price of $700 or a subscription of $200 per month. The stealer can pilfer sensitive information from a broad range of applications, including web browsers, cryptocurrency wallets, messengers, and emails. The collected information is bundled in a ZIP file and sent to the C2 server via a POST request.
  • Researchers uncovered a new wiper malware that targets modems and routers. Dubbed AcidRain, the malware was first spotted on February 24 after a cyber attack rendered Viasat KA-SAT modems inoperable in Ukraine. The malware strikes similarities with VPNFilter.

Related Threat Briefings

Feb 7, 2025

Cyware Weekly Threat Intelligence, February 03–07, 2025

PyPI is taking a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. The U.K is bringing earthquake-style metrics to cybersecurity with its new Cyber Monitoring Centre, designed to track digital disasters as precisely as natural ones. Inspired by the Richter scale, the CMC will quantify cyber incidents based on financial impact and affected users, offering clearer insights for national security planning. Kimsuky is back with another phishing trick, this time using fake Office and PDF files to sneak forceCopy malware onto victims' systems. Its latest campaign delivers PEBBLEDASH and RDP Wrapper by disguising malware as harmless shortcuts, ultimately hijacking browser credentials and sensitive data. Hackers have found a new way to skim credit card data - by hiding malware inside Google Tag Manager scripts. CISA is flagging major security holes in Microsoft Outlook and Sophos XG Firewall, urging agencies to patch them before February 27. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. Bitcoin scammers are switching tactics, swapping static images for video attachments in MMS to make their schemes more convincing. A recent case involved a tiny .3gp video luring victims into WhatsApp groups where scammers apply pressure to extract money or personal data. XE Group has shifted from credit card skimming to zero-day exploitation, now targeting manufacturing and distribution companies. A new version of ValleyRAT is making the rounds, using stealthy techniques to infiltrate systems. Morphisec found the malware being spread through fake Chrome downloads from a fraudulent Chinese telecom site.

Jan 10, 2025

Cyware Weekly Threat Intelligence, January 06–10, 2025

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes. China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner. A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection.

Dec 20, 2024

Cyware Weekly Threat Intelligence, December 16–20, 2024

In a digital age where borders are blurred, governments are sharpening their strategies to outpace cyber adversaries. The draft update to the National Cyber Incident Response Plan (NCIRP) introduces a comprehensive framework for managing nationwide cyberattacks that impact critical infrastructure and the economy. Meanwhile, the fiscal year 2025 defense policy bill, recently approved by the Senate, emphasizes strengthening cybersecurity measures both at home and abroad. A deceptive health app on the Amazon Appstore turned out to be a Trojan horse for spyware. Masquerading as BMI CalculationVsn, the app recorded device screens, intercepted SMS messages, and scanned for installed apps to steal sensitive data. Malicious extensions targeting developers and cryptocurrency projects have infiltrated the VSCode marketplace and NPM. Disguised as productivity tools, these extensions employed downloader functionality to deliver obfuscated PowerShell payloads. The BADBOX botnet has resurfaced, compromising over 192,000 Android devices, including high-end smartphones and smart TVs, directly from the supply chain. Industrial control systems are facing heightened risks as malware like Ramnit and Chaya_003 targets engineering workstations from Mitsubishi and Siemens. Both malware families exploit legitimate services, complicating detection and mitigation efforts in ICS environments. The Chinese hacking group Winnti has been leveraging a PHP backdoor called Glutton, targeting organizations in China and the U.S. This modular ELF-based malware facilitates tailored attacks across industries and even embeds itself into software packages to compromise other cybercriminals. A tax-themed phishing campaign, dubbed FLUX#CONSOLE, is deploying backdoor payloads to compromise systems in Pakistan. Threat actors employ phishing emails with double-extension files masquerading as PDFs.

Dec 13, 2024

Cyware Weekly Threat Intelligence, December 09–13, 2024

Cybercrime’s web of deception unraveled in South Korea as authorities dismantled a fraud network responsible for extorting $6.3 million through fake online trading platforms. Dubbed Operation Midas, the effort led to the arrest of 32 individuals and the seizure of 20 servers. In a significant move to combat surveillance abuses, the U.S. defense policy bill for 2025 introduced measures to shield military and diplomatic personnel from commercial spyware threats. The legislation calls for stringent cybersecurity standards, a review of spyware incidents, and regular reporting to Congress. The subtle art of deception found a new stage with a Microsoft Teams call, as attackers used social engineering to manipulate victims into granting remote access. By convincing users to install AnyDesk, they gained control of systems, executing commands to download the DarkGate malware. Russian APT Secret Blizzard has resurfaced and used the Amadey bot to infiltrate Ukrainian military devices and deploy their Tavdig backdoor. In a phishing spree dubbed "Aggressive Inventory Zombies (AIZ)," scammers impersonated brands like Etsy, Amazon, and Binance to target retail and crypto audiences. Surveillance has reached unsettling new depths with the discovery of BoneSpy and PlainGnome, two spyware families linked to the Russian group Gamaredon. Designed for extensive espionage, these Android malware tools track GPS, capture audio, and harvest data. A new Android banking trojan has already caused havoc among Indian users, masquerading as utility and banking apps to steal sensitive financial information. With 419 devices compromised, the malware intercepts SMS messages, exfiltrates personal data via Supabase, and even tricks victims into entering details under the pretense of bill payment. Iranian threat actors have set their sights on critical infrastructure, deploying IOCONTROL malware to infiltrate IoT and OT/SCADA systems in Israel and the U.S.

Dec 6, 2024

Cyware Weekly Threat Intelligence, December 02–06, 2024

NIST sharpened the tools for organizations to measure their cybersecurity readiness, addressing both technical and leadership challenges. The two-volume guidance blends data-driven assessments with managerial insights, emphasizing the critical role of leadership in applying findings. The Manson Market, a notorious hub for phishing networks, fell in a sweeping Europol-led takedown. With over 50 servers seized and 200TB of stolen data recovered, the operation spanned multiple countries, including Germany and Austria. Russian APT group BlueAlpha leveraged Cloudflare Tunnels to cloak its GammaDrop malware campaign from prying eyes. The group deployed HTML smuggling and DNS fast-fluxing to bypass detection, targeting Ukrainian organizations with precision. Earth Minotaur intensified its surveillance operations against Tibetan and Uyghur communities through the MOONSHINE exploit kit. The kit, now updated with newer exploits, enables the installation of the DarkNimbus backdoor on Android and Windows devices. Cloudflare Pages became an unwitting ally in the sharp rise of phishing campaigns, with a staggering 198% increase in abuse cases. Cybercriminals exploited the platform's infrastructure to host malicious pages, fueling a surge from 460 incidents in 2023 to over 1,370 by October 2024. DroidBot has quietly infiltrated over 77 cryptocurrency exchanges and banking apps, building a web of theft across Europe. Active since June 2024, this Android malware operates as a MaaS platform, enabling affiliates to tailor attacks. Rockstar 2FA, a phishing platform targeting Microsoft 365 users, has set the stage for large-scale credential theft. With over 5,000 phishing domains launched, the platform is marketed on Telegram. The Gafgyt malware is shifting gears, targeting exposed Docker Remote API servers through legitimate Docker images, creating botnets capable of launching DDoS attacks.